probably some program trying to access your router... download wireshark and have it capture all packets that are directed at your router, port 80, while you're not accessing the webif. have it running for 10-20 seconds to maybe have two the said packets, then look at them and see if you can configure out where they might come from.

I believe when a web browser connects to a web server it uses an ID of some kind, perhaps to do with submitting forms. If somehow the browser subsequently gets a different ID to what it is expecting, this message pops up. Perhaps someone more familiar with the protocols could comment if this is correct and if so, why it happens. Anyway, it seems to disappear when the browser page is refreshed. It could be your own browser or someone else on the network, or anything using HTTP to the router I guess. That might include UPnP for example. Anyway, it's nothing to worry about and is very common.